General

  • Target

    807675A50EE7545E02DAEAC9822842B7.exe

  • Size

    922KB

  • Sample

    240501-q2y1qagb5z

  • MD5

    807675a50ee7545e02daeac9822842b7

  • SHA1

    967094e1ef9155a031687396ba99855e54870612

  • SHA256

    2895f26ebeb8334731591ac868e9ab554a3568632e3c62e802739e5d0fc38d88

  • SHA512

    12a928dc23e7fd03996e5d41d8fce1d091b0fa979d379e63e6e89d58440f8a21a809a646e1c6431eda68d71515e1aed06219c4f3d8c0c86e25724b1d6e5af5b4

  • SSDEEP

    24576:e8inPEBCZN5hoVlnJXzJ/SEVSoMAALia4:Dg5BuxF/SRF4

Malware Config

Extracted

Family

stealc

C2

http://193.163.7.88

Attributes
  • url_path

    /a69d09b357e06b52.php

Targets

    • Target

      807675A50EE7545E02DAEAC9822842B7.exe

    • Size

      922KB

    • MD5

      807675a50ee7545e02daeac9822842b7

    • SHA1

      967094e1ef9155a031687396ba99855e54870612

    • SHA256

      2895f26ebeb8334731591ac868e9ab554a3568632e3c62e802739e5d0fc38d88

    • SHA512

      12a928dc23e7fd03996e5d41d8fce1d091b0fa979d379e63e6e89d58440f8a21a809a646e1c6431eda68d71515e1aed06219c4f3d8c0c86e25724b1d6e5af5b4

    • SSDEEP

      24576:e8inPEBCZN5hoVlnJXzJ/SEVSoMAALia4:Dg5BuxF/SRF4

    • Detects HijackLoader (aka IDAT Loader)

    • HijackLoader

      HijackLoader is a multistage loader first seen in 2023.

    • Stealc

      Stealc is an infostealer written in C++.

    • Downloads MZ/PE file

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks